CVE-2026-103083: WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability requires low-level privileges (PR:L). It is remotely reachable and does not require user interaction.

Q: What is the potential impact if exploitation succeeds?

The reported impact is limited to integrity and availability; confidentiality is not affected. The severity is medium, with a CVSS score of 5.4.

Q: Which plugin versions are affected?

Affected versions are reported as through 1.5.3. No fixed version is provided in the available data.

Published Oct 15, 2026

Updated

Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.5.3.

Affected Software

1 affected component

ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes<=1.5.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade elex-bulk-edit-products-prices-attributes-for-woocommerce-basic to a version that resolves this vulnerability.
Fixed in 1.5.4

Event History

Oct 15, 2026

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability requires low-level privileges (PR:L). It is remotely reachable and does not require user interaction.

What is the potential impact if exploitation succeeds?

The reported impact is limited to integrity and availability; confidentiality is not affected. The severity is medium, with a CVSS score of 5.4.

Which plugin versions are affected?

Affected versions are reported as through 1.5.3. No fixed version is provided in the available data.

CVE-2026-103083: WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which plugin versions are affected?